CVE-2026-74344

In the Linux kernel, the following vulnerability has been resolved: bpf: Clear rb node linkage when freeing bpfrbroot bpfrbrootfree detaches the root by copying the current rbrootcached and then replacing the live root with RBROOTCACHED. It then walks the copied root and drops each object contain...

CVE-2026-74344 bpf: Clear rb node linkage when freeing bpf_rb_root

In the Linux kernel, the following vulnerability has been resolved: bpf: Clear rb node linkage when freeing bpfrbroot bpfrbrootfree detaches the root by copying the current rbrootcached and then replacing the live root with RBROOTCACHED. It then walks the copied root and drops each object contain...

EUVD-2026-59492

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix endpoint/socket association handling Disassociating a socket from an endpoint via siwsocketdisassoc may release the last reference on that endpoint and free it. Therefore, don't clear the endpoints socket pointer...

EUVD-2026-59491

In the Linux kernel, the following vulnerability has been resolved: bpf: Clear rb node linkage when freeing bpfrbroot bpfrbrootfree detaches the root by copying the current rbrootcached and then replacing the live root with RBROOTCACHED. It then walks the copied root and drops each object contain...

CVE-2026-74345

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix endpoint/socket association handling Disassociating a socket from an endpoint via siwsocketdisassoc may release the last reference on that endpoint and free it. Therefore, don't clear the endpoints socket pointer...

CVE-2026-74345

The CVE-2026-74345 entry describes a Linux kernel vulnerability in the RDMA/siw driver where disassociating a socket from an endpoint may release the last reference to the endpoint, leading to a use-after-free if the endpoint’s socket pointer is cleared after the disassociation. The fix ensures t...

CVE-2026-74343

In the Linux kernel, the following vulnerability has been resolved: kernfs: fix xattr race condition with multiple superblocks Multiple superblocks with different namespaces can share the same kernfsnode when kernfstestsuper finds a matching root but different namespace. This means multiple inode...

CVE-2026-74341

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix heap overflow from oversized firmware HAL response The firmware response dispatcher copies all synchronous HAL responses into the 4096-byte halbuf without validating the response length. A response exceeding...

CVE-2026-74340

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from firmware count in PRINTREGINFO indication The firmware-controlled rsp-count field is used as the loop bound for indexing into the flexible rsp-regs array without validation against the message...

CVE-2026-74339

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Clear variable event pointer on read sndseqread copies a queued variable-length event header to userspace before expanding the payload. Queued variable-length events use SNDRVSEQEXTCHAINED internally, and data.ext.ptr...

CVE-2026-74338

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject sleepable BPFLSMCGROUP programs at load time The cgroup shim runs under rcureadlockdontmigrate, so we should not attach any sleepable BPF programs there. Add support to the verifier to explicitly reject attempts to lo...

CVE-2026-74337

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NMI/tracepoint re-entry deadlock on lru locks NMI and tracepoint BPF programs can re-enter the per-CPU or global LRU lock that bpflrupopfree/pushfree already hold on the same CPU, AA-deadlocking. Lockdep reports...

CVE-2026-74336

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bound S1G TIM PVB walk to the TIM element ieee80211s1gchecktim parses the S1G Partial Virtual Bitmap PVB of a received TIM element. The TIM is handed in as the element payload: ieee80211parseelemsfull stores...

CVE-2026-74334

In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: Fix locking when accessing mr-pd Sashiko points out that, due to reregmr, the PD is actually variable and all the touches in nldev are racy. Use mr-device instead of mr-pd-device. Getting the PD restrack ID is more...

CVE-2026-74332

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp-sdw-sof: Bound DAI link iteration createsdwdailinks walks sofdais until it finds an entry with initialised cleared, but sofdais is allocated with exactly numends entries. If all entries are initialised, the loop...

CVE-2026-74330

In the Linux kernel, the following vulnerability has been resolved: configfs: fix lockless traversals of -schildren Having the parent directory locked protects entries from removal by another thread, but it does not protect cursors from being moved around by lseek - or freed, for that matter...

CVE-2026-74329

In the Linux kernel, the following vulnerability has been resolved: watchdog: unregister PM notifier on watchdog unregister watchdogregisterdevice registers wdd-pmnb when WDOGNOPINGONSUSPEND is set, but watchdogunregisterdevice does not remove it. This leaves an embedded notifier block on the PM...

EUVD-2026-59477

In the Linux kernel, the following vulnerability has been resolved: configfs: fix lockless traversals of -schildren Having the parent directory locked protects entries from removal by another thread, but it does not protect cursors from being moved around by lseek - or freed, for that matter...

CVE-2026-74329 watchdog: unregister PM notifier on watchdog unregister

In the Linux kernel, the following vulnerability has been resolved: watchdog: unregister PM notifier on watchdog unregister watchdogregisterdevice registers wdd-pmnb when WDOGNOPINGONSUSPEND is set, but watchdogunregisterdevice does not remove it. This leaves an embedded notifier block on the PM...

EUVD-2026-59476

In the Linux kernel, the following vulnerability has been resolved: watchdog: unregister PM notifier on watchdog unregister watchdogregisterdevice registers wdd-pmnb when WDOGNOPINGONSUSPEND is set, but watchdogunregisterdevice does not remove it. This leaves an embedded notifier block on the PM...